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AMFN»MRNTS TO TH R CLAIMS 

The listing of claims will replace all prior versions, and lisUi.gs, of claims in Uie 
application: 



T istinP of Claims; 




Claim 1. (Currently Amend/d) In a networked environment, wherein one or more 
client computer systems make request/ for infomiation from a server computer system, the 
server computer system providing infeTmiation in response to the requests from the one or more 
client computer systems, the server /computer system having one or more listen sockets and 
tving a backlog queue for queuina/conncction requests that the seiner computer system cannot 
wrrcntly handle, a method nf t J server comoutcr system reducing denials of service even 
though the server computer sy^is experiencing a denial of service attack, the method 
comprising: 

receiving a plujfalitv of rfti^nection requests a tt empting g^eOftneeti^H-for -eaeh 
eea noclion rcgucot roc/ivod by U io l iu v o r oomputor oyrA o m from said one or more client 
computer systems; 

^■stah )ishing L connection soc V^t f"'" »t least one of the pUirality of conncctj^ 
requests without placing the ""n^T^inn r^^nt>.!t in a backlog queue; 

for each dinnection request that for which the seiver computer system cannot 
currently a connection socket , placing the conrtection request in a the 

backlog queue Xhout then establishing a co "^-'^tiori f^or.Vct- wherein the backlQi>_aucue 
inrh,A^< ponne ^tion requests without r ^parrt fo ^ whether or not the connection request 
includes assooiated request data ; 

mon i toring tho backlog q«euei 
dete^iining that tlie backlog queue is being used; 

aefe-^oo ucction oockolo upon notifioation that th e backlog qu e iw 

in /resDonse t» i>i>^ H^termiTiation. identif y ing anv connecl ioiLSOcket s that have no 
received tequcst data; and 

lisconneetii^ff the identified connec tion sockets. 
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Claim 2. (Original) The meAod in accordance with Claim 1. forthcr comprising 
mapping each connection request to a co^esponding listen socket. 

Claim 3. (Original) The /lethod in accordance with Claim 2. wherein each listen 
socket has a corresponding backlog q^euc. 

Claim 4. (Original) t/c method in accordance with Claim 3, wherein placing the 
connection request in a backlo/ queue comprises placing the request in the backlog queue 
conesponding to die listen socki that the connection request mapped to. 

Claim 5. (Curre^ly Amended) The method in accordance with Claim 1, wherein 
g cu iu i ULl i u u f u / o n rh rnnnrr M nn rr qii-^ ^r ,:.„n A hy thn n n r^r n r ro m PBtei^steffl 
&9f«-sai d on e or moro cliyht r^ mput o r o yotom s eslablishing a <;pnncction socket Ibr at least o ne 
of the plurality of conne xion requests is performed using a Winsock module. 

Claim 6. /currently Amended) The method in accordance with Claim 1, wherein 
attempting g conno/ion n«t:.hHshing a co nn.xtion sopket fo r at le agLon c pf the pluralit jLof 
r^T^nt^ntionrc Quesi comprises calling a module that accepts connections and waits for associated 
request tlata before completing. 

Claim/7. (Currently Amended) The method in accordance with Claim 6, wherein 
the module/hat accepts connects and waits for associated request data before completing 
comprises / Winsock()AcceptExO module. 

/laim 8. (Currently Amended) The method in accordance with Claim 1 , whe«in 
rnrther /comorising m onitoring the backlog queu c^ . the dct-erminatiQ^) beSnS m^dc while 
monit/ring the backlog Quenc comprisDJ calling a m udu l u that acnno t it I nn-i t the backlog quouo 
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Claim 9. (Oirrent Amended) The /lelhod in accordance with Claim I[8|| 12, 
wherein determining that the backlog queue isyteing used conipriscs detecting that the moaule 
that scans at least the backlog queue has rctumfcd. 



Claim 10. (Currently Amend* 
wherein the module that scans at 1< 
WinsockOscleclO module. 



llie method in accordance with Claim [|81| 12, 
livsl the backlog queue for activity comprises a 



Claim 1 1. (Original) Tlie ^ethod in accordance with Claim 10, wherein determining 
that the backlog queue is being used/omprises detecting that the WinsockQselectO module has 
rctumcd. 

Claim 12. (Currently/Amended) The mcthotl in accordance with Claim |U1I 8, 
wherein n.nnitoriTig the bac Vin/q"^"^ comnrisps r^llin^ a module that scansaUeagUh&backlog 
nueae for activity yesa Ung o/c or m et^^ u cc ti u n aooUcta upon n o tir H3ati««-^iat-d^e-baeklog 
quouo is b e ing us e d compriaoa tho foUowmg :- 

data; and 

di s oono^oting tho id e ntified connection aook e ts . 

Claim 13. / (Ciurently Amended) The method in accordance; with Claim [[121) 1, 
wherein idaitifjX any connection sockets that have comiections but no received request data 

comprises the allowing: 

callin/ a module that identifies the state of the connection socket. 

Cl/m 14. (Original) The method in accordance with Claim 13, wherein the modulo 
tliat idcnfifies tlie state of the comiection socket comprises a WinsockOgi»tsockopt() module. 

Claim 15. (Currently Amended) The method in accordance with Claim I. further 
conofprising: 
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detcraiiTicd to be used 
disconnection is ncrfi 



specifying a Jrace period betw«»H spanning the lime Ihc backlog queue is 



and the time th.^ iHc^niificd sockets arc d lsctmn^ctcd, wticajiijhs 
»^i Y ''^ backlog que ue still has entries aRor the_a:a£S 



period oi^moffl a m iootion r nrl mt '- ii u lu a lo allow th o . m> or-^«>mp«4ei^ystem-to 
emp^ he baolJ u i^ qjouo, wh nrn in t t tc n ii^u l lu ig uf a m uiie o r m n n ^ ro n nor l iefl-s<»Gk-et»4fi 



pcrfonnod only if th e 



Claim 16. (Cancelled) 



backlog quouo still haa ontri < 



Claim 1 7. (Cum ntly Amended) A computer program product for use in a networked 



environment, wherein one ot 
server computer system, the 



or more listen sockets and 



more client computer systems make requests for informalion from a 
server computer system providing information in response to the 



requests from the one or mere client computer systems, the server computer system having one 



having a backlog queue for queuing coraiection requests thai the 
server computer system can lot currently handle, a computer program product for implementing 
a method nf the server computer system reducing denials of service c;ven though the server 



computer system is experiencing a denial of service attack, wherein the computer program 
product comprises compu er-executable instructions which, when executed by a processor. 



implements the following 
Receiving a 



pInrflHt y of connection requests ottompting - a connoction C &r-eaeh 
fe ccivod by flio flci-vor oomputor oyst e m from said one or more client 



eewe etion request 
computer systems^ 

ecti^Mkhii ig a conncctin.1 socket for 4 ^^^^ of the plutalily_Q f connection 
req uests vfithout falacinp ; the connect ion request in a backlog queue: 

for each/connection request that for which the server computer system cannot 
currently Ivaadi f.stah1ish a connection socket, placing the connection request in a 
backlog q..Aii rLihmit then cstablishj nff « rnnnection sockct.jgdtercin the backlog qucjis 
inr.lurtes connlt^tinn requests w ilho.it regard for whether or nOtJhACOimgstmniSauM 
includes ass( ^yiated request data: 

monitoring th e backlog qu e u e ; 

dctcrinining that the backlog queue is being used; 
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fe sotUng one or ^or & 



inresnonsetott g rtetcnubatioii. i Hc..^ h rving any connection sockets lh aLhav€.iig 



received request data: ai id 



Claim 18. (Origiiialj) 
further comprising computer 
corresponding listen socket. 



connection Gock a ta upon nolin rnlio n 4ttaHhfr%a6kte^eHe 



H;i/>r>nnpftinfT th e identified connection so ckets. 



The computer program product in accordance with Claim 17, 
■elceculable instructions for mapping each connection request to a 
each listen socket has a corresponding backlog queue. 



wlercin I 



Claim 19. (Origina ) The computer program product in accordance with Claim 17, 
wherein the computer-exccutiblc instructions for placing the connection request in a backlog 
queue comprise computer-exLtablc instructions for placing the request in the backlog queue 
corresponding to the listen scjbkct that the connection request mapped to. 

Claim 20. (Currfently Amended) The computer program product in accordance with 
Claim 17, wherein the coAputer-executablo instructions for Qttomptmg -»-€eB«eotion for each 

cum i iia i u u r oqucjt ro rni ^i fl hy t U o li cii v e i iuiny> )'>'!''"■ ri"in -n i fl nn o n r m n re oltetrt 

^mputor :y:tcmj rstahlis hine a co n nection socket f- '-"ff! ""'^ "^'^^^ plurality of connection 
requests comprises at leaJl portions of a Winsock module. 

Claim 21. (qancellcd) 

Claim 22. (Currently Amended) The computer program product in accordance with 
Claim 17, further comirising computer-exccutable instructions for performing the following: 

specifying a grace period between spanning the time the backlog queue is 
determined tJbe used and the time the identified sockets are disc onnected, whcrejiUhe 
rii^jm nnectioi is performed onlv if the backlog qiiPiie still hafi entries ?fler thc_£mcc 
period one ot more uom i c ction aoc]cot G n r c r nnp t to allow the sei ^ c i oomputor o ^^rstom -te 
e mpty tho blcklog guouo, where i n the rooctting of tlio ono or m c)Ffr-eefweetteft^ok-etfr4s 
per foi-mod Jnly if the backlog gu u u c i it ill Im^ m it iin nf^n rt hr g r o B e-pefiod. 
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Claim 23. (Canc jUed) 




Claim 24. (CurrJLtly Amended) In a networked environmenl, wherein one or more 
client computer systems Jkc requests for information from a server computer system, the 
server computer system providing information in response to the requests fmm the one or more 
client computer systems. th«. server computer system having one or more listen sockets, each 
listen socket having a backhg queue for queuing connection requests that the server computer 
system cannot currently har.dle, a method of th r_.r irver computer syste m reducing denials of 
service ev«i though the serfer computer system is experiencing a denial of service attack, the 

method comprising: 

receiving_a 



c em^cction request ^ecei^ 
computer systems; 
e gtablishm 



phi^- ^litv of connection rcQuests dttempting-a-eeRfteotion for each 

ftputor oyatem from said one or more client 



a nnnnection sockP t f- ""'^ plurality of cojmccUQa 



requests using a W insockQAcccptExQ modul e w ithout placing the connection rs questln. 

a backlog queue : 

mapping each connection request to a corresponding listen socket; 

for each connection request that for which tlie server computer system cannot 
currently hm4i^ |.t^Mish a connection socket , placing the connection request in the 

backlog queue co 
wherein the bac 



,1 responding to the listen socket that the connection request mapped to, 
np queue inch'HeR connection requests w ithoiilr ggjird for whcthCT OI 



not the connectioji request includes a iMOciated request data; 

monitorig tlie backlog queue using a WinsockOselcctQ module; 

detcrmiling Hiat the backlog queue is being used by detecting that the 
WinsockOselectf) module has returned; 

identifying any connection sockets that have connections but no received request 

data using a W nsock()gctsockoptO module; and 

discormccting the identified connection sockets. 
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25. (Currently Ameiic)^) The method in accordance with Claim 24. further 
comprising: 

specifying ^gracc period betw«e« sp.annmg the time the backlog queue is 
determined to bc/ed and the time the identified connection sockets arc disconnected, 
wherein the diZnnection is performed only if the backlog queue slill has entries after 
the ferace ppriod. 
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